The shared enrollment_uri/print_enrollment now take the CA the link should
carry, for ai-app's iris client -- an APK cross-compiled somewhere other
than the machine its server runs on, which therefore cannot pin at build
time. This app is built on the machine it talks to, so it passes None and
its QR is unchanged; the reason is written at the call site.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A Rust backend that discovers Android projects under configured roots,
builds one on request, and serves the APK over pinned TLS on a WireGuard
interface; an Android client that lists what is buildable, watches a build,
and installs the result. Enrolment carries the token and the CA, so the
phone trusts exactly the machine that issued it and nothing else.
`AGENTS.md` is the working guide and `README.md` the configuration
reference. The shared tunnel-and-TLS code lives in `vendor/wg-app-link`,
which ai-app uses too.
History before this point was squashed away, and a stale `config.json` went
with it: nothing had read that file since the config moved to RON outside
the checkout, and what it still held was one machine's absolute paths and
the names of projects on it.
irisandClaude Fable 5.1